Description

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T23:18:03.220Z",
  "pubdate": "2026-09-04T23:18:03.220Z",
  "executiveSummary": "Unidata netcdf-c versions through 4.10.1 are susceptible to a memory corruption vulnerability identified as an out-of-bounds write within the NC4_HDF5_inq_attname() function.\nThe vulnerability originates from a failure to perform bounds checking when processing HDF5 attribute names, which are copied into a statically allocated 256-byte buffer.\nSuccessful exploitation allows a malicious actor to craft a specially prepared HDF5 file containing an attribute name exceeding the destination buffer's capacity, resulting in a heap or stack-based buffer overflow.\nThis flaw can lead to arbitrary memory corruption, potentially triggering application crashes, denial-of-service conditions, or the execution of arbitrary code depending on the memory layout and the surrounding calling context.\nThe vulnerability is exploitable locally by convincing a victim to open a maliciously crafted netCDF/HDF5 file using an affected version of the netcdf-c library.\nThe risk profile is significant for data-processing pipelines and scientific applications that rely on unverified input files for model analysis or data interpretation, as the memory corruption occurs during the attribute enumeration phase of the library's HDF5 interface.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of data transfer routines within the NC4_HDF5_inq_attname() function, which is a component of the netcdf-c library responsible for HDF5 backend operations. When the library is tasked with querying the name of an attribute associated with an HDF5 object, it retrieves the attribute name string from the underlying HDF5 file structure.\nThe implementation utilizes a fixed-length memory buffer of exactly 256 bytes to hold the copied attribute name. Crucially, the code fails to validate the length of the incoming HDF5 attribute name against the target buffer's capacity before initiating the copy operation. Consequently, if an attacker crafts an HDF5 file where an attribute name length exceeds 255 bytes plus the null terminator, the copy operation performs an out-of-bounds write, overwriting adjacent memory regions.\nThe attack flow proceeds as follows: 1) An attacker generates a malicious HDF5 container file with a manipulated attribute header containing a string length significantly larger than 256 bytes. 2) The attacker distributes this file to a target system or user. 3) The target application, linked against a vulnerable version of netcdf-c, invokes the library function NC4_HDF5_inq_attname() to inspect the attributes of the file. 4) The library parses the malicious attribute name and copies it into the constrained 256-byte internal buffer. 5) The buffer overflow occurs, corrupting the process's stack or heap memory. 6) This corruption can be leveraged to hijack control flow, overwrite critical data structures, or induce a segmentation fault leading to a crash.\nThe impact of this memory corruption is dependent on the target's operating environment and the application's memory protection mechanisms (e.g., ASLR, DEP). Since the corruption occurs during file enumeration, it is highly reproducible upon the parsing of the malicious metadata. The library operates as a shared object; therefore, any software utilizing the netcdf-c library to interact with HDF5-based files is potentially vulnerable if it allows the processing of untrusted or externally sourced files. No specific authentication or privilege level is required to trigger the crash; the primary constraint is the target user's interaction with the malicious input file."
}